How to Create a User in Kubernetes?

Kubernetes is a popular container orchestration platform that offers a robust set of features for managing containerized workloads at scale. One of the key aspects of Kubernetes is its authentication and authorization system, which allows you to control who has access to your Kubernetes resources.

In Kubernetes, authentication is the process of verifying the identity of a user or service account, while authorization is the process of determining what actions a user or service account is allowed to perform. Kubernetes supports several authentication mechanisms, including client certificates, bearer tokens, and OpenID Connect.

In this article, we'll focus on how to create a user in Kubernetes using client certificates. Client certificates provide a secure way to authenticate users and services, and are commonly used in production Kubernetes clusters.

Creating a client certificate for a user involves several steps, including generating a private key, creating a certificate signing request (CSR), and signing the CSR with a certificate authority (CA). Let's walk through each step in detail.

Step 1: Generate a private key

The first step in creating a client certificate for a user is to generate a private key. The private key is used to sign the certificate and must be kept secret. To generate a private key, you can use the OpenSSL command-line tool, which is available on most Unix-based systems.

To generate a private key with OpenSSL, run the following command:

openssl genrsa -out user.key 2048

This command generates a new 2048-bit RSA private key and saves it to a file called user.key.

Step 2: Create a certificate signing request

The next step is to create a certificate signing request (CSR) using the private key generated in step 1. The CSR contains information about the user, such as their name and email address, and is used to request a digital certificate from a certificate authority (CA).

To create a CSR with OpenSSL, run the following command:

openssl req -new -key user.key -out user.csr -subj "/CN=<username>/O=<orgname>"

Replace and with the desired username and organization name, respectively. The -subj flag specifies the subject of the CSR, which includes information such as the common name (CN) and organization (O) of the user.

Step 3: Sign the certificate with a certificate authority

The next step is to sign the CSR with a certificate authority (CA). A CA is a trusted entity that issues digital certificates, which are used to authenticate users and services. In a production environment, you would typically use a public CA such as Let's Encrypt or DigiCert. However, for testing purposes, you can create a self-signed CA using OpenSSL.

To create a self-signed CA with OpenSSL, run the following commands:

openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/CN=kubernetes-ca"

The first command generates a new 2048-bit RSA private key for the CA and saves it to a file called ca.key. The second command generates a self-signed X.509 certificate for the CA and saves it to a file called ca.crt. The -subj flag specifies the subject of the certificate, which in this case is simply "kubernetes-ca".

With the CA certificate and key in hand, you can now sign the user's CSR to generate a digital certificate. To do this, run the following command:

openssl x509 -req -in user.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out user.crt

Once the user and the role binding are created, we need to generate a kubeconfig file for the user. This kubeconfig file contains information about the user and the cluster, which is used by kubectl to authenticate the user.

To generate a kubeconfig file, we can use the following command:

kubectl config set-credentials <username> --client-certificate=<path-to-cert> --client-key=<path-to-key> --embed-certs=true

This command sets up the user's client certificate and key and embeds the CA certificate in the kubeconfig file. The kubeconfig file can then be accessed by the user to authenticate with the cluster.

To verify that the user has been set up correctly, we can switch to the user's context and run a kubectl command:

kubectl config use-context <user-context>
kubectl get pods

If the command returns a list of pods, the user has been successfully authenticated and authorized to access the Kubernetes cluster.

In summary, creating a user in Kubernetes involves the following steps:

Step 4. Generate a private key for the user

Generate a certificate signing request (CSR) for the user
Sign the CSR using a Kubernetes CA certificate
Create a role and role binding for the user
Generate a kubeconfig file for the user
By following these steps, we can create a user in Kubernetes and enable them to access the cluster with the appropriate permissions. It is important to note that proper user management is essential for maintaining the security and integrity of a Kubernetes cluster.